Files
ScadaBridge/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/SmtpConfigurationPageTests.cs
T
Joseph Doherty b104760b3a feat(auth)!: ScadaBridge canonical roles + SoD collapse (Audit→Administrator, AuditReadOnly→Viewer) + config-DB migration (Task 1.7)
Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
  Admin        -> Administrator
  Design       -> Designer
  Deployment   -> Deployer
  Audit        -> Administrator   (COLLAPSE; accepted privilege escalation)
  AuditReadOnly-> Viewer          (COLLAPSE; keeps audit-read, no export)

SoD: OperationalAuditRoles = { Administrator, Viewer },
     AuditExportRoles      = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).

Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
  honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
  admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
  is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
  dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
  Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
  operator-added rows. Down is lossy on the collapse (documented in-file).
  No pending model changes.

Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.

CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.
2026-06-02 08:00:47 -04:00

114 lines
4.0 KiB
C#

using System.Security.Claims;
using ZB.MOM.WW.ScadaBridge.Security;
using Bunit;
using Microsoft.AspNetCore.Components.Authorization;
using Microsoft.Extensions.DependencyInjection;
using NSubstitute;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications;
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
using SmtpConfigurationPage = ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Notifications.SmtpConfiguration;
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Pages;
/// <summary>
/// bUnit rendering tests for the SMTP Configuration page — specifically the TlsMode
/// field added so the UI exposes all five user-relevant SmtpConfiguration fields.
/// </summary>
public class SmtpConfigurationPageTests : BunitContext
{
private void WireAuth()
{
var claims = new[]
{
new Claim(JwtTokenService.UsernameClaimType, "tester"),
new Claim(JwtTokenService.RoleClaimType, "Administrator"),
};
var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(user));
Services.AddAuthorizationCore();
}
private static SmtpConfiguration Sample() =>
new("smtp.example.com", "Basic", "noreply@example.com")
{
Id = 1,
Port = 587,
TlsMode = "StartTLS",
Credentials = "user:pass",
};
[Fact]
public void EditForm_RendersTlsModeSelectWithAllThreeModes()
{
var repo = Substitute.For<INotificationRepository>();
repo.GetAllSmtpConfigurationsAsync()
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
new List<SmtpConfiguration> { Sample() }));
Services.AddSingleton(repo);
WireAuth();
var cut = Render<SmtpConfigurationPage>();
cut.WaitForState(() => cut.Markup.Contains("smtp.example.com"));
cut.FindAll("button").First(b => b.TextContent.Contains("Edit")).Click();
cut.WaitForAssertion(() =>
{
var selects = cut.FindAll("select");
var tlsSelect = selects.Single(s => s.QuerySelectorAll("option")
.Any(o => o.TextContent == "StartTLS"));
var modes = tlsSelect.QuerySelectorAll("option").Select(o => o.TextContent).ToList();
Assert.Equal(new[] { "None", "StartTLS", "SSL" }, modes);
});
}
[Fact]
public void ReadOnlyView_ShowsTlsMode()
{
var repo = Substitute.For<INotificationRepository>();
repo.GetAllSmtpConfigurationsAsync()
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
new List<SmtpConfiguration> { Sample() }));
Services.AddSingleton(repo);
WireAuth();
var cut = Render<SmtpConfigurationPage>();
cut.WaitForAssertion(() =>
{
Assert.Contains("TLS Mode", cut.Markup);
Assert.Contains("StartTLS", cut.Markup);
});
}
[Fact]
public void SavingEdit_PersistsChosenTlsMode()
{
var config = Sample();
var repo = Substitute.For<INotificationRepository>();
repo.GetAllSmtpConfigurationsAsync()
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
new List<SmtpConfiguration> { config }));
Services.AddSingleton(repo);
WireAuth();
var cut = Render<SmtpConfigurationPage>();
cut.WaitForState(() => cut.Markup.Contains("smtp.example.com"));
cut.FindAll("button").First(b => b.TextContent.Contains("Edit")).Click();
var tlsSelect = cut.FindAll("select")
.Single(s => s.QuerySelectorAll("option").Any(o => o.TextContent == "StartTLS"));
tlsSelect.Change("SSL");
cut.FindAll("button").First(b => b.TextContent.Contains("Save")).Click();
cut.WaitForAssertion(() =>
{
repo.Received().UpdateSmtpConfigurationAsync(
Arg.Is<SmtpConfiguration>(c => c.TlsMode == "SSL"));
repo.Received().SaveChangesAsync();
});
}
}